This Privacy Policy explains how crēation™'s affiliated entities in the Kingdom of Saudi Arabia and the Arab Republic of Egypt (together, "crēation™," "we," "us," or "our") collect, use, disclose, and protect personal data when you visit www.crēation™.sa (the "Site") or otherwise interact with us — for example, by submitting an enquiry, applying for a role, or engaging us for creative and design services in either country.
This Policy is designed to comply with: (a) the Saudi Personal Data Protection Law and its Executive Regulations ("PDPL"), supervised by the Saudi Data and AI Authority ("SDAIA"); and (b) the Egyptian Personal Data Protection Law No. 151 of 2020 and its Executive Regulations ("Egyptian PDPL"), supervised by the Personal Data Protection Center ("PDPC"). Where these two legal frameworks (or regulatory authorities) differ, we apply the standard that provides the highest level of protection for your rights, or the standard specific to your relationship with the relevant crēation™ entity as outlined below.
crēation™ operates through two separately registered legal entities:
crēation™ (Kingdom of Saudi Arabia): crēation™ EST.
Address: Roshn Business Front, Riyadh, Saudi Arabia
crēation™ (Egypt): crēation™ LLC.
Address: 3 Waheeb Doos, Maadi, Cairo, Egypt
For general use of the Site — browsing, or submitting a general enquiry — crēation™ (Kingdom of Saudi Arabia), based in Riyadh, acts as the primary Data Controller. Where you engage crēation™'s Egypt office directly for a project, application, or other local engagement, crēation™ (Egypt) acts as the Data Controller for that relationship. Either entity can be contacted using the details in Section 15.
We only collect personal data that is necessary for the purposes described in this Policy, and we take reasonable technical and organizational measures to keep it accurate, secure, and confidential — consistently across both the KSA and Egypt entities. This Policy should be read together with any project- or engagement-specific terms we agree with you (for example, in a client contract), which will govern where more specific.
Depending on how you interact with us, we may process the following categories of personal data:
Contact and enquiry data: name, email address, phone number, company, and the content of any message you send us through a contact form or by email.
Candidate data: name, contact details, CV/resume, portfolio links, and any other information you submit when applying for a role with us in either country.
Client and project data: contact and billing details, and information exchanged in the course of a creative or design engagement.
Usage data: pages visited, time spent on the Site, referring pages, and general navigation patterns.
Technical data: IP address, browser type and version, device type, operating system, and time zone setting.
We do not knowingly collect sensitive data (such as data revealing racial or ethnic origin, religious beliefs, health information, or biometric data) through the Site, unless you voluntarily provide it to us and a valid legal basis applies under the PDPL and/or Egypt PDPL.
Enquiries and business development: When you contact us through the Site, we use your information to respond to your enquiry, provide requested information about our services, and, where relevant, take steps toward entering into an agreement with you. This processing relies on our legitimate interest in growing our business and, where applicable, on steps taken at your request prior to a contract.
Client engagements: Where you become a client of either crēation™ entity, that entity processes your personal data as necessary to perform its contract with you — including project communications, invoicing, and account management.
Recruitment: If you apply for a role with us — in the Kingdom of Saudi Arabia, in Egypt, or otherwise — the relevant crēation™ entity processes the personal data in your application to evaluate your candidacy, conduct interviews, and manage its hiring process. We retain candidate data for a reasonable period to support recruitment and, where you consent, to consider you for future opportunities. You may ask us to delete your application data at any time by contacting privacy@crēation™.sa.
Marketing: Where you have opted in, we may send you updates about our work, services, or events. You can unsubscribe at any time via the link in any marketing email or by contacting us directly.
Legal basis: We process personal data where: (i) it is necessary to perform a contract with you; (ii) we have a legitimate interest that is not overridden by your rights (such as responding to enquiries or improving the Site); (iii) you have given consent; or (iv) processing is necessary to comply with a legal obligation under the PDPL, the Egypt PDPL, or other applicable law.
The Site uses cookies and similar technologies to remember your preferences, understand how visitors use the Site, and improve its performance. Analytics data is used in aggregate and is not used to build an individual profile of you beyond what is necessary for these purposes. You can manage or disable cookies through your browser settings or, where offered, through our cookie banner; disabling certain cookies may affect Site functionality.
We may rely on trusted third-party service providers to help us operate the Site and our business in both countries — such as hosting providers, analytics services, email platforms, and project management tools. These providers only process personal data on our instructions, for the purposes described in this Policy, and are contractually required to protect it in line with applicable data protection law.
We do not sell your personal data. We may share it with: (a) service providers acting on our behalf as described above; (b) professional advisors where necessary; (c) government or regulatory authorities in the Kingdom of Saudi Arabia or the Arab Republic of Egypt where required by law; or (d) a successor entity in the event of a merger, acquisition, or sale of assets. In each case, we share only what is reasonably necessary.
Because crēation™ operates through affiliated entities in two countries, personal data may be shared between the crēation™ KSA entity and the crēation™ Egypt entity where necessary for the purposes described in this Policy — for example, where a project or candidate application involves both offices. Each such transfer is made subject to appropriate contractual and technical safeguards.
Where personal data is transferred outside the Kingdom of Saudi Arabia or the Arab Republic of Egypt, we ensure appropriate safeguards are in place in accordance with the PDPL, the Egypt PDPL, and their respective implementing regulations, such as verifying the recipient country provides an adequate level of protection or putting contractual safeguards in place.
We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law in the Kingdom of Saudi Arabia or the Arab Republic of Egypt (for example, tax or corporate record-keeping obligations). When personal data is no longer needed, we securely delete or anonymize it.
The Site is not directed at children, and we do not knowingly collect personal data from individuals under the age of 18. If you believe a child has provided us with personal data, please contact us at privacy@crēation™.sa so we can delete it.
We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is completely secure, and we encourage you to take care when sharing personal data online.
Subject to the PDPL, the Egypt PDPL, and their respective implementing regulations, you have the right to:
Be informed about how your personal data is collected and used.
Access the personal data we hold about you.
Request correction of inaccurate or incomplete personal data.
Request deletion of your personal data, subject to applicable legal exceptions.
Withdraw consent at any time, where processing is based on consent.
Object to or restrict certain processing, including for direct marketing.
Request a copy of your personal data in a portable format, where technically feasible.
Lodge a complaint with the relevant regulator — SDAIA if your data is processed by crēation™ (Kingdom of Saudi Arabia), or the Personal Data Protection Center (PDPC) if your data is processed by crēation™ (Egypt).
To exercise any of these rights, contact us at privacy@crēation™.sa, noting whether your relationship is with crēation™ (Kingdom of Saudi Arabia) or crēation™ (Egypt) if known, so we can route your request to the correct entity. We may need to verify your identity before responding, and we aim to respond within the timeframes required under the applicable law.
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements in either country. We will post the revised Policy on this page with an updated effective date, and, where the changes are material, we will provide additional notice.
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us at:
crēation™
privacy@crēation™.sa
crēation™ (Kingdom of Saudi Arabia): Roshn Business Front, Riyadh, Saudi Arabia
crēation™ (Egypt): 3 Waheeb Doos, Maadi, Cairo, Egypt